Splunk Search

Search query to retrive host upon selection

imthesplunker
Path Finder

Hi,

I have 2 versions with multiple hosts containing dev and stg environment
version1 is 7.2 with host1, host2,... host10(5 dev & 5 stg hosts)
version2 is 8.1 with host1, host2,....host10(3 dev & 7 stg hosts)

I have created dropdown for version(11.2,12.1) and multiselect for enviornment(dev,stg) .
What will be the search query to retrieve host based on selection (for ex :- version1 and stg env )

0 Karma
1 Solution

gokadroid
Motivator

If you are able to search events like index=yourIndex sourcetype=yourScourcetype "11.2" (host=host1 OR host=host2) to return all events of version 11.2 for hosts host1 or host2 then follow the below approach and ensure you have following points covered:

  1. Take a note of the token for your dropdown, I will call it tok_dropdown_version
  2. Take a note of the token for your multiselect, I will call it myToken
  3. Take a note of this answer on multiselect which tells you how to form a query of type (field1=value1 OR field1=value2) which in your case will be host=host1 OR host=host2 and so on (however many values will be selected from multiselect).

With these three as arsenal then your final query shall be like

index=yourIndex sourcetype=yourSourcetype $tok_dropdown_version$ ($myToken$)

View solution in original post

0 Karma

gokadroid
Motivator

If you are able to search events like index=yourIndex sourcetype=yourScourcetype "11.2" (host=host1 OR host=host2) to return all events of version 11.2 for hosts host1 or host2 then follow the below approach and ensure you have following points covered:

  1. Take a note of the token for your dropdown, I will call it tok_dropdown_version
  2. Take a note of the token for your multiselect, I will call it myToken
  3. Take a note of this answer on multiselect which tells you how to form a query of type (field1=value1 OR field1=value2) which in your case will be host=host1 OR host=host2 and so on (however many values will be selected from multiselect).

With these three as arsenal then your final query shall be like

index=yourIndex sourcetype=yourSourcetype $tok_dropdown_version$ ($myToken$)
0 Karma

imthesplunker
Path Finder

This helped me .thanks

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...